Beyond the Mcse: Active Directory for the Security Professional
summary
Active Directory secures 95% of Fortune 1000 firms and the talk lays out concrete attack and defense artifacts: exploitation of MS14-068 to forge Kerberos tickets, Group Policy MiTM via MS15-011/MS15-014, RODC password replication rules, and weak DSRM passwords used for persistent DC access. Demonstrations use PowerShell modules (notably PowerView) and Mimikatz-style tools to enumerate ACLs, find adminSDHolder/adminCount=1 misconfigurations, and show how improper GPO delegation or service accounts lead to full forest compromise. 2016 features (PAM/TTL, bastion forests) are proposed mitigations.
AI-written summary · about
chapters (20)
- 0:00Introduction and agenda
- 1:36Differing views of AD
- 2:31AD architecture basics
- 3:47Forest and domain boundaries
- 5:15Trusts and exploitation
- 6:59Cloud, federation, and AD
- 8:54Domain controller security
- 14:14DSRM and local administration
- 15:20Client finding and auditing
- 17:49Attribute risks and GPO
- 22:39NTLM authentication risks
- 24:15Kerberos security issues
- 26:01Common AD security issues
- 34:00Managing administrative rights
- 36:01GPO and delegation hazards
- 37:06Custom delegation risks
- 39:00AdminSDHolder and inheritance
- 39:44Modern AD security features
- 43:59Summary and conclusions
- 46:54Q&A session
related talks
40mTop Active Directory Attacks: Understand, then Prevent and Detect
50mHybrid Active Directory Attacks: Anatomy and Defenses
53mThe Importance of Identity-Centric Security in 2024
37mThreat Hunting in Active Directory Environment
23mHacking Exposed: Next-Generation Tactics, Techniques, and Procedures
55mOffensive Azure Security
40mWhat’s Old is New: Hybrid Security for Microsoft Azure and On-Premises Tech
44mWhere 2 Worlds Collide: Bringing Mimikatz et al to UNIX